SECURITY: Fix extension detection with 2 .'s

Fix IE6 extension detection, to prevent XSS in the API response.

Bug: 52746
Change-Id: If58a81b62209b36bd143a1766a8a20c9c34dbe3b

diff --git a/includes/libs/IEUrlExtension.php b/includes/libs/IEUrlExtension.php
index 79387e6..49d05d4 100644 (file)
--- a/includes/libs/IEUrlExtension.php
+++ b/includes/libs/IEUrlExtension.php
@@ -232,7 +232,7 @@ class IEUrlExtension {
                        }
                        // We found an illegal character or another dot
                        // Skip to that character and continue the loop
-                       $pos = $nextPos + 1;
+                       $pos = $nextPos;
                        $remainingLength = $urlLength - $pos;
                }
                return false;

diff --git a/tests/phpunit/includes/libs/IEUrlExtensionTest.php b/tests/phpunit/includes/libs/IEUrlExtensionTest.php
index 984907b..d04dd7d 100644 (file)
--- a/tests/phpunit/includes/libs/IEUrlExtensionTest.php
+++ b/tests/phpunit/includes/libs/IEUrlExtensionTest.php
@@ -115,4 +115,12 @@ class IEUrlExtensionTest extends MediaWikiTestCase {
                        'Dot at end of string'
                );
        }
+
+       function testTwoDots() {
+               $this->assertEquals(
+                       'z',
+                       IEUrlExtension::findIE6Extension( 'x.y.z' ),
+                       'Two dots'
+               );
+       }
 }